Skip to content

Commit 624095c

Browse files
author
Lee Fine
committed
1 parent f867239 commit 624095c

File tree

10 files changed

+32
-16
lines changed

10 files changed

+32
-16
lines changed

‎CHANGELOG.md‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,5 @@
11
v2.12.0
2-
- Added config.json setting and its override store level custom field - AllowShellCommands. If "N" (default "Y"), SFTP will be used to create stores and move files on Linux-based certificate store servers. No Linux shell commands will be used in the integration. Limitations when running in this mode exist:
3-
- config.json/custom field values SeparateUploadFilePath, DefaultLinuxPermissionsOnStoreCreation, DefaultOwnerOnStoreCreation, LinuxFilePermissionsOnStoreCreation, and LinuxFileOwnerOnStoreCreation cannot be used and will be ignored
4-
- rare issue where a certificate store user id having an expired password causes the orchestrator to hang when attempting an SFTP/SCP connection will NOT be able to be caught and handled
2+
- Added config.json setting and its override store level custom field - AllowShellCommands. If "N" (default "Y"), SFTP will be used to create stores and move files on Linux-based certificate store servers. No Linux shell commands will be used in the integration.
53

64
v2.11.4
75
- Bug Fix: Handle condition where a certificate store definition that contains an invalid value for `FileTransferProtocol`

‎RemoteFile/ApplicationSettings.cs‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -41,6 +41,7 @@ public enum FileTransferProtocolEnum
4141
public static string DefaultSudoImpersonatedUser { get { return configuration.ContainsKey("DefaultSudoImpersonatedUser") ? configuration["DefaultSudoImpersonatedUser"] : DEFAULT_SUDO_IMPERSONATION_SETTING; } }
4242
public static bool CreateCSROnDevice { get { return configuration.ContainsKey("CreateCSROnDevice") ? configuration["CreateCSROnDevice"]?.ToUpper() == "Y" : false; } }
4343
public static string TempFilePathForODKG { get { return configuration.ContainsKey("TempFilePathForODKG") ? configuration["TempFilePathForODKG"] : string.Empty; } }
44+
public static bool UseShellCommands { get { return configuration.ContainsKey("UseShellCommands") ? configuration["UseShellCommands"]?.ToUpper() == "Y" : false; } }
4445
public static int SSHPort
4546
{
4647
get

‎RemoteFile/Discovery.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ public JobResult ProcessJob(DiscoveryJobConfiguration config, SubmitDiscoveryUpd
5959
ApplicationSettings.Initialize(this.GetType().Assembly.Location);
6060

6161
certificateStore = new RemoteCertificateStore(config.ClientMachine, userName, userPassword, directoriesToSearch[0].Substring(0, 1) == "/" ? RemoteCertificateStore.ServerTypeEnum.Linux : RemoteCertificateStore.ServerTypeEnum.Windows, ApplicationSettings.SSHPort);
62-
certificateStore.Initialize(ApplicationSettings.DefaultSudoImpersonatedUser);
62+
certificateStore.Initialize(ApplicationSettings.DefaultSudoImpersonatedUser, true);
6363

6464
if (directoriesToSearch.Length == 0)
6565
throw new RemoteFileException("Blank or missing search directories for Discovery.");

‎RemoteFile/InventoryBase.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ public JobResult ProcessJob(InventoryJobConfiguration config, SubmitInventoryUpd
4040
SetJobProperties(config, config.CertificateStoreDetails, logger);
4141

4242
certificateStore = new RemoteCertificateStore(config.CertificateStoreDetails.ClientMachine, UserName, UserPassword, config.CertificateStoreDetails.StorePath, StorePassword, FileTransferProtocol, SSHPort, IncludePortInSPN);
43-
certificateStore.Initialize(SudoImpersonatedUser);
43+
certificateStore.Initialize(SudoImpersonatedUser, UseShellCommands);
4444
certificateStore.LoadCertificateStore(certificateStoreSerializer, true);
4545

4646
List<X509Certificate2Collection> collections = certificateStore.GetCertificateChains();

‎RemoteFile/ManagementBase.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ public JobResult ProcessJob(ManagementJobConfiguration config)
3838
SetJobProperties(config, config.CertificateStoreDetails, logger);
3939

4040
certificateStore = new RemoteCertificateStore(config.CertificateStoreDetails.ClientMachine, UserName, UserPassword, config.CertificateStoreDetails.StorePath, StorePassword, FileTransferProtocol, SSHPort, IncludePortInSPN);
41-
certificateStore.Initialize(SudoImpersonatedUser);
41+
certificateStore.Initialize(SudoImpersonatedUser, UseShellCommands);
4242

4343
PathFile storePathFile = RemoteCertificateStore.SplitStorePathFile(config.CertificateStoreDetails.StorePath);
4444

‎RemoteFile/ReenrollmentBase.cs‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -68,7 +68,7 @@ public JobResult ProcessJobToDo(ReenrollmentJobConfiguration config, SubmitReenr
6868
ApplicationSettings.FileTransferProtocolEnum fileTransferProtocol = ApplicationSettings.FileTransferProtocol;
6969

7070
certificateStore = new RemoteCertificateStore(config.CertificateStoreDetails.ClientMachine, UserName, UserPassword, config.CertificateStoreDetails.StorePath, StorePassword, fileTransferProtocol, SSHPort, IncludePortInSPN);
71-
certificateStore.Initialize(SudoImpersonatedUser);
71+
certificateStore.Initialize(SudoImpersonatedUser, UseShellCommands);
7272

7373
PathFile storePathFile = RemoteCertificateStore.SplitStorePathFile(config.CertificateStoreDetails.StorePath);
7474

‎RemoteFile/RemoteCertificateStore.cs‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -453,14 +453,14 @@ internal string GenerateCSROnDevice(string subjectText, SupportedKeyTypeEnum key
453453
return csr;
454454
}
455455

456-
internal void Initialize(string sudoImpersonatedUser)
456+
internal void Initialize(string sudoImpersonatedUser, bool useShellCommands)
457457
{
458458
logger.MethodEntry(LogLevel.Debug);
459459

460460
bool treatAsLocal = Server.ToLower().EndsWith(LOCAL_MACHINE_SUFFIX);
461461

462462
if (ServerType == ServerTypeEnum.Linux || RuntimeInformation.IsOSPlatform(OSPlatform.Linux))
463-
RemoteHandler = treatAsLocal ? new LinuxLocalHandler() as IRemoteHandler : new SSHHandler(Server, ServerId, ServerPassword, ServerType == ServerTypeEnum.Linux, FileTransferProtocol, SSHPort, sudoImpersonatedUser) as IRemoteHandler;
463+
RemoteHandler = treatAsLocal ? new LinuxLocalHandler() as IRemoteHandler : new SSHHandler(Server, ServerId, ServerPassword, ServerType == ServerTypeEnum.Linux, FileTransferProtocol, SSHPort, sudoImpersonatedUser, useShellCommands) as IRemoteHandler;
464464
else
465465
RemoteHandler = new WinRMHandler(Server, ServerId, ServerPassword, treatAsLocal, IncludePortInSPN);
466466

‎RemoteFile/RemoteFileJobTypeBase.cs‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,7 @@ public abstract class RemoteFileJobTypeBase
2929
internal bool IncludePortInSPN { get; set; }
3030
internal ApplicationSettings.FileTransferProtocolEnum FileTransferProtocol { get; set; }
3131
internal bool CreateCSROnDevice { get; set; }
32+
internal bool UseShellCommands { get; set; }
3233
internal string KeyType { get; set; }
3334
internal int KeySize { get; set; }
3435
internal string SubjectText { get; set; }
@@ -57,7 +58,7 @@ internal void SetJobProperties(JobConfiguration config, CertificateStore certifi
5758
ApplicationSettings.DefaultSudoImpersonatedUser :
5859
properties.SudoImpersonatedUser.Value;
5960

60-
SSHPort = properties.SSHPort == null || string.IsNullOrEmpty(properties.SSHPort.Value) || !int.TryParse(properties.SSHPort.Value, out int notUsed) ?
61+
SSHPort = properties.SSHPort == null || string.IsNullOrEmpty(properties.SSHPort.Value) || !int.TryParse(properties.SSHPort.Value, out int _) ?
6162
ApplicationSettings.SSHPort :
6263
properties.SSHPort;
6364

@@ -73,6 +74,10 @@ internal void SetJobProperties(JobConfiguration config, CertificateStore certifi
7374
ApplicationSettings.CreateCSROnDevice :
7475
Convert.ToBoolean(properties.CreateCSROnDevice.Value);
7576

77+
UseShellCommands = properties.UseShellCommands == null || string.IsNullOrEmpty(properties.UseShellCommands.Value) || !int.TryParse(properties.UseShellCommands.Value, out int _) ?
78+
ApplicationSettings.UseShellCommands :
79+
properties.UseShellCommands;
80+
7681
FileTransferProtocol = ApplicationSettings.FileTransferProtocol;
7782
if (properties.FileTransferProtocol != null && !string.IsNullOrEmpty(properties.FileTransferProtocol.Value))
7883
{

‎RemoteFile/RemoteHandlers/SSHHandler.cs‎

Lines changed: 12 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -31,18 +31,20 @@ class SSHHandler : BaseRemoteHandler
3131
private string SudoImpersonatedUser { get; set; }
3232
private ApplicationSettings.FileTransferProtocolEnum FileTransferProtocol { get; set; }
3333
private bool IsStoreServerLinux { get; set; }
34+
private bool UseShellCommands { get; set; }
3435
private string UserId { get; set; }
3536
private string Password { get; set; }
3637
private SshClient sshClient;
3738

38-
internal SSHHandler(string server, string serverLogin, string serverPassword, bool isStoreServerLinux, ApplicationSettings.FileTransferProtocolEnum fileTransferProtocol, int sshPort, string sudoImpersonatedUser)
39+
internal SSHHandler(string server, string serverLogin, string serverPassword, bool isStoreServerLinux, ApplicationSettings.FileTransferProtocolEnum fileTransferProtocol, int sshPort, string sudoImpersonatedUser, bool useShellCommands)
3940
{
4041
_logger.MethodEntry(LogLevel.Debug);
4142

4243
Server = server;
4344
SudoImpersonatedUser = sudoImpersonatedUser;
4445
FileTransferProtocol = fileTransferProtocol;
4546
IsStoreServerLinux = isStoreServerLinux;
47+
UseShellCommands = useShellCommands;
4648
UserId = serverLogin;
4749
Password = serverPassword;
4850

@@ -80,7 +82,8 @@ internal SSHHandler(string server, string serverLogin, string serverPassword, bo
8082
sshClient.Connect();
8183

8284
//method call below necessary to check edge condition where password for user id has expired. SCP (and possibly SFTP) download hangs in that scenario
83-
CheckConnection();
85+
if (useShellCommands)
86+
CheckConnection();
8487
}
8588
catch (Exception ex)
8689
{
@@ -368,13 +371,18 @@ public override void CreateEmptyStoreFile(string path, string linuxFilePermissio
368371
if (IsStoreServerLinux)
369372
{
370373
string pathOnly = string.Empty;
371-
SplitStorePathFile(path, out pathOnly, out _);
374+
string fileName = string.Empty;
375+
SplitStorePathFile(path, out pathOnly, out fileName);
372376

373377
linuxFilePermissions = string.IsNullOrEmpty(linuxFilePermissions) ? GetFolderPermissions(pathOnly) : linuxFilePermissions;
374378
linuxFileOwner = string.IsNullOrEmpty(linuxFileOwner) ? GetFolderOwner(pathOnly) : linuxFileOwner;
375379

376380
AreLinuxPermissionsValid(linuxFilePermissions);
377-
RunCommand($"install -m {linuxFilePermissions} -o {linuxFileOwner} {linuxFileGroup} /dev/null {path}", null, ApplicationSettings.UseSudo, null);
381+
382+
if (UseShellCommands)
383+
RunCommand($"install -m {linuxFilePermissions} -o {linuxFileOwner} {linuxFileGroup} /dev/null {path}", null, ApplicationSettings.UseSudo, null);
384+
else
385+
UploadCertificateFile(pathOnly, fileName, Array.Empty<byte>());
378386
}
379387
else
380388
RunCommand($@"Out-File -FilePath ""{path}""", null, false, null);

‎docsource/content.md‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -185,11 +185,15 @@ restrictions will be in place when using RemoteFile in this mode:
185185
LinuxFilePermissionsOnStoreCreation, and LinuxFileOwnerOnStoreCreation are not supported and will be ignored. As a result, file
186186
permissions and ownership when creating a certificate store or adding a certificate to an existing store will be based
187187
on the user assigned to the Command certificate store and other Linux environmental settings.
188-
2. A rare issue exists where a certificate store user id having an expired password causes the orchestrator to hang when attempting an
188+
2. Discovery jobs are excluded and will still use the shell `find` command
189+
3. A rare issue exists where a certificate store user id having an expired password causes the orchestrator to hang when attempting an
189190
SFTP/SCP connection. A modification was added to check for this condition. Running RemoteFile with Use Shell Commands = N will
190191
cause this validation check to NOT occur.
191-
3. Both RFORA and RFKDB use proprietary CLI commands in order to manage their respective certificate stores. These commands
192+
4. Both RFORA and RFKDB use proprietary CLI commands in order to manage their respective certificate stores. These commands
192193
will still be executed when Use Shell Commands is set to Y.
194+
5. If executing in local mode (|LocalMachine at the end of your client machine name for your certificate store), Use Shell
195+
Commands = 'N' will have no effect. Shell commands will continue to be used because there will be no SSH connection
196+
available to use SFTP with.
193197

194198

195199
## Developer Notes

0 commit comments

Comments
 (0)